4 ms·
Had to double check if we were reading the same post. This isn't meant for home users. It costs a lot of money and is targeting enterprise users. Defender ATP i
by badrabbit 6y ago
Had to double check if we were reading the same post. This isn't meant for home users. It costs a lot of money and is targeting enterprise users. Defender ATP is like Carbonblack or Crowdstrike falcon which support windows and Linux. MS finally supports Linux to compete better. It's a great product but you need E5 license for it.
- ghostpepper 6y agoSo it's not the same windows defender product given to consumers? What additional features does Defender ATP have?
- staticassertion 6y agoDefender ATP is closer to an EDR tool, which means it's designed for detection and response teams, not individual users. It'll take more a reporting and contextualizing approach than an av that is typically blocking.
- badrabbit 6y agoIt's not an antivirus, it doesn't care about binary signatures. It looks attack patterns based on known attacker behavior. A good linux example would be httpd starting netcat that connects to a remote port. Or firefox spawning a bash shell. For windows a simple example would be when an office app starts wscript or powershell and that child process schedules taks, wmi, downloads a payload,etc... Those are simple examples but they track more complex attack scenarios, for cloud hosted solutions like defender atp and crowdstrike they also collect everything that happens on every device of every customer, so if they find new malware or an attacker with a certain TTP on one device, they will deploy rules to catch that for all their customers.